Retrieve a List of Malop Activity Types

Endpoint URL: https://<your server>/rest/v2/customRules/getMalopActivityTypes
Endpoint URI: /v2/customRules/getMalopActivityTypes

Action: GET

Returns a list of all available MalOp activity types you can use for the custom detection rule.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file with cookie details with every request.

None

URL/URI parameters: none

Request Body Parameters: none

This request can return the following status codes:

200: Success OK

The response includes a list of the supported activity types for any generated Malop:

Field

Type

Description

enumName

Enum

The possible values for the activity type used in a generated Malop. The possible values for this field vary:

CNC_COMMUNICATION
DATA_THEFT
MALICIOUS_INFECTION
LATERAL_MOVEMENT
PRIVILEGE_ESCALATION
RANSOMWARE
SCANNING
STOLEN_CREDENTIALS

translation

String

The regular language for the detection type.

None

Important information is found in these fields:

enumName parameter: The unique value the Cybereason platform uses for the activity types.
translation parameter: The real language name for the activity type.

Request

curl --request GET \
  --url https://12.34.56.78/v2/rest/customRules/getMalopActivityTypes \
  --header 'Content-Type:application/json' \

Response

[
  {
    "enumName":"MALICIOUS_INFECTION",
    "translation":"Infection"
  },
  {
    "enumName":"PRIVILEGE_ESCALATION",
    "translation":"Privilege escalation"
  },
  {
    "enumName":"RANSOMWARE",
    "translation":"Ransomware"
  },
  {
    "enumName":"SCANNING",
    "translation":"Scanning"
  },
  {
    "enumName":"LATERAL_MOVEMENT",
    "translation":"Lateral movement"
  },
  {
    "enumName":"CNC_COMMUNICATION",
    "translation":"C&C"
  },
  {
    "enumName":"DATA_THEFT",
    "translation":"Data theft"
  },
  {
    "enumName":"STOLEN_CREDENTIALS",
    "translation":"Stolen credentials"
  }
]

Request

Use this request body:

Response

[
   {
     "enumName":"MALICIOUS_INFECTION",
     "translation":"Infection"
   },
   {
     "enumName":"PRIVILEGE_ESCALATION",
     "translation":"Privilege escalation"
   },
   {
     "enumName":"RANSOMWARE",
     "translation":"Ransomware"
   },
   {
     "enumName":"SCANNING",
     "translation":"Scanning"
   },
   {
     "enumName":"LATERAL_MOVEMENT",
     "translation":"Lateral movement"
   },
   {
     "enumName":"CNC_COMMUNICATION",
     "translation":"C&C"
   },
   {
     "enumName":"DATA_THEFT",
     "translation":"Data theft"
   },
   {
     "enumName":"STOLEN_CREDENTIALS",
     "translation":"Stolen credentials"
   }
 ]

Request

Download Python script

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

import requests
import json

# Login information

username = "[email protected]"
password = "mypassword"
server = "yourserver.com"
port = "443"

data = {
    "username": username,
    "password": password
}

headers = {"Content-Type": "application/json"}

base_url = "https://" + server + ":" + port

login_url = base_url + "/login.html"

session = requests.session()

login_response = session.post(login_url, data=data, verify=True)

print (login_response.status_code)
print (session.cookies.items())

# Request URL

endpoint_url = "/rest/v2/customRules/getMalopActivityTypes"

api_url = base_url + endpoint_url

api_headers = {'Content-Type':'application/json'}

api_response = session.request("GET", api_url, headers=api_headers)

your_response = json.loads(api_response.content)

print(json.dumps(your_response, indent=4, sort_keys=True))

Response

[
  {
    "enumName":"MALICIOUS_INFECTION",
    "translation":"Infection"
  },
  {
    "enumName":"PRIVILEGE_ESCALATION",
    "translation":"Privilege escalation"
  },
  {
    "enumName":"RANSOMWARE",
    "translation":"Ransomware"
  },
  {
    "enumName":"SCANNING",
    "translation":"Scanning"
  },
  {
    "enumName":"LATERAL_MOVEMENT",
    "translation":"Lateral movement"
  },
  {
    "enumName":"CNC_COMMUNICATION",
    "translation":"C&C"
  },
  {
    "enumName":"DATA_THEFT",
    "translation":"Data theft"
  },
  {
    "enumName":"STOLEN_CREDENTIALS",
    "translation":"Stolen credentials"
  }
]